[Fsuk-manchester] SWF verification in BBC iPlayer (was: Fsuk-manchester Digest, Vol 45, Issue 1)

[Simon Ward]

On Sun, Mar 27, 2011 at 09:24:00AM +0100, Tom Chiverton wrote:
> On Wednesday 02 March 2011 16:26:25 Ben Webb wrote:
> > > There's nothing particularly dodgy about doing it this way, this stream is
> > > available to iPhone users, the software just pretends to be an iPhone, as 
> > > I
> > > understand it.
> > 
> > Actually the iPhone stream is low quality and becoming increasingly
> > more difficult to get. "flashvhigh" means you're actually getting the
> > same stream the flash player would, over rtmp.
> 
> I thought the BBC were using 'SWF verification' to stop you impersonating 
> their player. Any idea if I'm wrong, or if get_iplayer does something clever ?

You’re not wrong, they are, but the implementation of SWF verification
is (was?) flawed.

Firstly, in the BBC’s implementation, SWF verification requests were
only sent for some frames, and not always the same frames.  The client
(in the case of get_iplayer it uses rtmpdump[1] or flvstreamer[2]
underneath) could just ignore the request, and restart the download from
the same point.  Mostly it worked, but at worst you might get a single
dropped frames every so often, which doesn’t affect the stream too much.

Something changed, and this no longer worked as reliably.  So next we
look at how the SWF verification works:  SWF verification tries to
verify that the “official” client is being used.  This is just the SWF
file, that is stored on the streaming server, publicly accessible.  The
information used to verify this SWF file is being used is derived from
the SWF file itself.  All clients need to do is obtain this file (or the
information generated from the file), and when transmit it when asked
for it.

[1]: http://rtmpdump.mplayerhq.hu/
[2]: http://savannah.nongnu.org/projects/flvstreamer

get_iplayer can be configured for SWF verification for BBC’s player by
installing rtmpdump, and adding something like the following to
~/.get_iplayer/options:

flvstreamer /usr/bin/rtmpdump
rtmptvopts --swfVfy http://www.bbc.co.uk/emp/10player.swf
rtmpradioopts --swfVfy http://www.bbc.co.uk/emp/10player.swf

Simon
-- 
A complex system that works is invariably found to have evolved from a
simple system that works.—John Gall

signature.asc
Description: Digital signature